How it works

KYB starts with verifying the entity itself, using registration documents, registry extracts and tax identifiers. It then maps the ownership chain to identify the natural persons who ultimately own or control the business, verifies those beneficial owners using KYC methods, and screens the entity, its directors and owners against sanctions, PEP and adverse media sources. The result is a business risk rating that drives monitoring intensity and review frequency.

Requirements by jurisdiction

• US: The CDD Rule (31 CFR 1010.230) requires covered institutions to identify and verify each individual owning 25% or more of a legal entity customer and one individual with significant managerial control. A FinCEN exceptive relief order of 13 February 2026 means institutions need to re-verify beneficial owners only at first account opening, when facts call prior information into question, or as their risk-based procedures require, rather than at every new account. Separately, FinCEN has removed Corporate Transparency Act beneficial ownership reporting for US companies, so institutions cannot rely on that registry for domestic entities.

• EU: Under AMLR Article 52, beneficial ownership through ownership is "25% or more" of shares or voting rights, with control assessed in parallel; the Commission may set a lower threshold, no higher than 15%, for higher-risk entity categories. These rules apply from 10 July 2027.

• UK: The Money Laundering Regulations 2017 use a "more than 25%" ownership test and require firms to report material discrepancies with the Companies House register.

Common challenges

Layered and cross-border ownership structures, nominee arrangements and trusts make beneficial owners hard to establish. Registry data varies in quality between jurisdictions, and ownership changes after onboarding are easy to miss.

How teams handle it in practice

Teams pull registry data programmatically, build ownership graphs to calculate indirect stakes, and require documentary evidence where registries are incomplete. Ownership-change events trigger re-verification. Compliance platforms like Corsa can keep entity and ownership data linked so that a change in one party updates related risk scores.